Skip to main content

Kemp LoadMaster

Knocknoc integrates with the Kemp LoadMaster to dynamically control network access. Knocknoc dynamically manages the LoadMaster's global allowlist. As users authenticate and grants expire, Knocknoc adds and removes entries in the allowlist, so access is granted in seconds.

This is an active integration: Knocknoc pushes changes to the LoadMaster directly. If you would prefer a poll-based setup where a device fetches a Knocknoc-hosted feed on its own schedule, use the EDL (Passive) Knoc type instead.

Requirements

  • A LoadMaster running firmware with the RESTful API (LMOS 7.x or newer).
  • The API Interface enabled so Knocknoc can reach the LoadMaster API.
  • A LoadMaster user account (username and password) with permission to manage the global ACL.
  • Network reachability from the host running Knocknoc to the LoadMaster management address.

Step 1: Enable the API Interface

  1. In the WUI, go to Certificates & Security > Remote Access.
  2. Enable the API Interface.
  3. If you restrict management access by source address, allow the IP that Knocknoc connects from.

Kemp LoadMaster Remote Access page with the API Interface enabled

Step 2: Enable the Packet Routing Filter

The global allowlist lives under the Packet Routing Filter. Go to System Configuration > Network Setup > Packet Routing Filter and confirm it is enabled.

Kemp LoadMaster Packet Routing Filter page showing it enabled

Step 3: Create a user

  1. Go to System Configuration > System Administration > User Management.
  2. Add a new user (for example knocknoc-agent) with a strong password, and grant it All Permissions.

Kemp LoadMaster User Management page with a user that has All Permissions

Step 4: Configure the Knocknoc Backend

In the Knocknoc admin wizard, create a Knoc and choose the Application type, Active mode, Kemp LoadMaster vendor. Fill in:

Field Value
Kemp LoadMaster URL https://<loadmaster-host> (include the port if non-default)
Insecure Tick only if the LoadMaster uses a self-signed certificate
Username The LoadMaster user from Step 3.
Password That user's password.

Click Validate connection to confirm Knocknoc can reach the LoadMaster and read the allowlist, then save.

The create-knoc wizard walks through the following steps.

Configure Settings - choose the Active mode.

Create-knoc wizard Configure Settings step with Active mode selected

Configure Settings - enter the Kemp LoadMaster details. Select the Kemp LoadMaster vendor and fill in the URL, username and password. Tick Insecure only for a self-signed certificate.

Kemp LoadMaster backend fields in the Configure Settings step

Knoc Options - set the grant behaviour.

Knoc Options step of the create-knoc wizard

Agent - choose the agent that reaches the LoadMaster. Only agents that support the Kemp LoadMaster backend can be selected.

Agent step showing the Kemp-capable agent selected

Select users - grant access to users or groups.

Select users step of the create-knoc wizard

Review - run the connection check and create the Knoc. The read-only connection check confirms the LoadMaster is reachable and the allowlist is readable before you save.

Review step with the Kemp LoadMaster connection check passing

Error Codes

When a Kemp LoadMaster operation fails, Knocknoc shows the relevant error code in the wizard. Use the tables below to find the cause and fix.

Connection and Authentication (KEMP000-KEMP049)

Code Description Common Causes
KEMP000 Failed to connect to the LoadMaster Hostname unreachable, DNS failure, or connection refused. Check the LoadMaster is online and the Kemp LoadMaster URL is correct.
KEMP001 LoadMaster authentication failed HTTP 401. Verify the Username and Password are correct and the user has All Permissions.
KEMP002 LoadMaster authorization failed The user account lacks the permissions to manage the global ACL (HTTP 403). Grant the user All Permissions.
KEMP003 LoadMaster TLS/SSL certificate error Self-signed or untrusted certificate. Install a trusted certificate or tick Insecure in the backend configuration.
KEMP004 LoadMaster connection timed out Network timeout. Check connectivity between Knocknoc and the LoadMaster.
KEMP005 API Interface not enabled The API endpoint was not found (HTTP 404). Enable the API Interface under Certificates & Security > Remote Access.

Allowlist Operations (KEMP100-KEMP149)

Code Description Common Causes
KEMP100 Failed to list the allowlist Permission gap (see KEMP002) or the API Interface is disabled (see KEMP005).
KEMP101 Failed to add an allowlist entry The user can read but not modify the global ACL, or the address was rejected by the LoadMaster.
KEMP102 Failed to remove an allowlist entry The user can read but not modify the global ACL, or a transient LoadMaster error.

Response Parsing (KEMP400-KEMP449)

Code Description Common Causes
KEMP400 Invalid or unexpected response Transient LoadMaster-side error, or a proxy between Knocknoc and the LoadMaster rewriting the response body.

Vendor Documentation

Back to top